Data storage policy

This Data Storage Policy establishes the requirements for the secure, lawful and proportionate storage, retention, backup, transfer and disposal of information handled by Wesoftek Solutions Private Limited in connection with its direct selling agent business operated under the brand Paisanow.com.

1. Purpose

To protect customer, employee, Lending Partner and Company information throughout its lifecycle; ensure that data is stored only in approved locations; prevent unauthorised duplication, access, alteration, loss or disclosure; and support contractual, legal, regulatory, operational and business-continuity requirements.

2. Scope

This Policy applies to all directors, employees, consultants, contractors, agents, vendors and other authorised persons who create, receive, access, transmit, store, archive or dispose of Company information. It covers electronic records, paper records, audio or call recordings, images, logs, backups, removable media, emails and data processed through cloud or third-party systems.

3. Data covered

• Customer identity, contact, demographic and application information.
• KYC records, PAN and other officially valid documents, photographs and verification outputs.
• Financial, employment, income, bank-statement, credit, eligibility and loan-processing information.
• Data received from or shared with banks, NBFCs, credit information companies, account aggregators, KYC providers and other authorised service providers.
• Employee, vendor, commercial, accounting, legal, compliance and corporate records.
• Platform source code, databases, security logs, analytics, configurations, credentials, intellectual property and confidential business information.

4. Data classification

Information is classified according to its sensitivity, business value and applicable obligations:

• Restricted — authentication secrets, encryption keys, high-risk security data and any information whose exposure could cause severe harm. Access is strictly limited.
• Protected Confidential — personal data, KYC and financial records, Lending Partner information, contracts, employee records, source code and non-public business information.
• Internal — routine operational information intended for authorised personnel and service providers.
• Public — information approved for unrestricted publication, including published website content and marketing material.

Where classification is uncertain, the higher protection level applies until the data owner or the Information Security and Privacy function determines otherwise.

5. Approved storage locations

• Company-approved cloud services, databases, document repositories, ticketing systems and business applications configured with appropriate security controls.
• Company-managed endpoints that are encrypted, access-controlled, patched and enrolled in approved security management systems.
• Approved Lending Partner or service-provider portals where storage is necessary for an authorised transaction.
• Secure physical facilities, locked cabinets or controlled record rooms for paper records.
• Approved backup systems that are segregated, encrypted where appropriate and subject to tested restoration procedures.

6. Prohibited storage and duplication

• Personal email accounts, consumer file-sharing services, unauthorised messaging platforms or personal cloud drives.
• Unmanaged personal computers, phones, removable drives or other devices unless expressly approved and secured.
• Unencrypted portable media or local folders used as permanent repositories.
• Duplicate, shadow or convenience copies when an authoritative record already exists.
• Screenshots, downloads, printouts or exports of customer data beyond what is necessary for an authorised task.
• Storage of passwords, PINs, bank transaction credentials or OTPs. Personnel must never request or retain such credentials.

Temporary copies created for a legitimate purpose receive the same protection as the source record and must be securely deleted immediately after the purpose is completed.

7. Storage limitation and data minimisation

Only data that is adequate, relevant and necessary for a defined business, contractual or legal purpose may be collected and stored. Systems and forms avoid mandatory fields that are unnecessary for the requested product. Access to full KYC, financial or credit information must not be retained merely for convenience or speculative future use.

8. Access control

• Access is granted on least-privilege and need-to-know principles and approved by the responsible data or system owner.
• Unique user accounts and strong authentication, including multi-factor authentication for higher-risk systems, must be used.
• Privileged access is restricted, logged and reviewed periodically.
• Access rights are reviewed when roles change and revoked promptly on separation or when no longer required.
• Shared accounts are prohibited unless technically unavoidable, formally approved and subject to compensating controls.
• Personnel must lock screens, safeguard credentials and immediately report suspected compromise.

9. Encryption and transmission

Protected Confidential and Restricted information must be encrypted in transit over public or untrusted networks, and encrypted at rest where appropriate to the risk, system capability and applicable requirement. Encryption keys and secrets are stored separately, access-controlled, rotated and backed up under approved key-management procedures.

Customer documents and application data may be transmitted only through approved secure channels. Sensitive data must not be placed in unsecured email bodies or messaging groups. Where email transfer is authorised, appropriate encryption, password protection, recipient verification and data minimisation must be used.

10. Cloud services and external processors

• A security and privacy assessment is completed before engaging a material storage, hosting or processing provider.
• Contracts address confidentiality, permitted processing, security controls, incident notification, audit or assurance, subcontracting, return and deletion, and applicable location or transfer restrictions.
• Providers may process data only on documented instructions and for the approved purpose.
• We maintain an inventory of material processors and storage locations and periodically review their compliance.
• Exit plans provide for secure migration, return and verified deletion without avoidable interruption or data loss.

11. Lending Partner data

Information obtained from or processed for a bank, NBFC or other Lending Partner is stored and handled in accordance with the empanelment agreement, partner instructions and applicable financial-sector requirements. Partner data is logically segregated where required and must not be reused for another partner, product, marketing activity or independent purpose without lawful authority.

12. Data location and cross-border processing

We maintain visibility over the countries and facilities in which material data is stored or processed. Storage and transfers comply with applicable data-protection requirements, government restrictions, contractual obligations and any sector-specific localisation requirement. A transfer outside India must use approved providers and appropriate contractual, technical and organisational safeguards.

13. Retention

Data is retained only for as long as required for the purpose for which it was collected, an active enquiry or loan application, the relationship with a Lending Partner, statutory or regulatory recordkeeping, audit, fraud prevention, dispute resolution, legal claims or a valid legal hold. We maintain a retention schedule identifying record categories, owners, minimum and maximum periods and disposal methods.

• Unsuccessful or abandoned application records are periodically reviewed and deleted or anonymised when no longer required.
• Marketing data is suppressed or deleted following valid withdrawal or opt-out, except for a minimal suppression record where necessary.
• Logs and security records are retained for a period proportionate to investigation, audit and compliance needs.
• Legal holds override scheduled deletion only for the records and period reasonably necessary.
• Backups may retain deleted records for a limited cycle but are not restored for ordinary business use after deletion unless necessary for disaster recovery or legal compliance.

14. Backups and business continuity

• Critical systems and data are backed up at a frequency consistent with approved recovery objectives.
• Backups are protected from unauthorised alteration, ransomware and deletion through segregation, immutability or equivalent controls where appropriate.
• Restoration is tested periodically and test results documented.
• Backup access is restricted and logged.
• Business-continuity plans identify critical data dependencies, recovery priorities and responsible personnel.

15. Physical and hardcopy records

Paper records containing Protected Confidential or Restricted information are clearly controlled, stored in locked cabinets or secure rooms, and accessed only by authorised personnel. Clear-desk practices are followed. Files taken off-site require specific approval, secure transport and tracking. Printing is minimised and abandoned printouts must be destroyed securely.

16. Secure disposal

Electronic data is securely erased, cryptographically deleted, anonymised or made irretrievable using a method appropriate to the media and risk. Paper is cross-cut shredded or destroyed through an approved confidential-waste provider. Storage devices are sanitised or physically destroyed before disposal, return, reuse or resale. Disposal of material records is documented.

17. Monitoring, logging and assurance

We may monitor systems, access, downloads, transfers, administrative actions and security events for legitimate security, compliance and operational purposes, subject to applicable law. Periodic access reviews, vulnerability assessments, backup tests, vendor reviews and audits are conducted according to risk. Identified deficiencies have assigned owners and remediation dates.

18. Personal data requests and consent withdrawal

Requests for access, correction, erasure or withdrawal of consent should be directed to privacy@paisanow.com. A verified request is routed promptly to the Privacy function and the relevant system or data owners. Deletion is subject to applicable legal, contractual, partner and legal-hold requirements. Withdrawal operates prospectively and does not invalidate processing already lawfully undertaken.

19. Security incidents and data breaches

• Any loss, unauthorised access, misdirected communication, malware event, suspicious download or disclosure must be reported immediately through approved internal escalation channels.
• Personnel must preserve evidence and must not conceal, independently investigate or delete affected records unless instructed by the incident-response team.
• We contain and assess the incident, identify affected data and persons, coordinate with Lending Partners and vendors, remediate vulnerabilities and document decisions.
• Notices to affected persons, regulators, partners or authorities are made in the form and timeframe required by applicable law and contract.

20. Roles and responsibilities

• Board and senior management — approve risk appetite, allocate resources and oversee compliance.
• Information Security and Privacy function — maintain standards, assess risk, coordinate incidents, monitor compliance and advise data owners.
• Data and system owners — classify information, approve access, define retention and ensure appropriate controls.
• Technology teams — implement secure architecture, access control, encryption, logging, backup, patching and deletion capabilities.
• Human Resources — manage personnel confidentiality, onboarding, training, role changes and prompt offboarding.
• All personnel — comply with this Policy, use approved systems, minimise copies and report incidents or weaknesses.
• Vendors and processors — comply with contractual security, confidentiality, retention, deletion and incident obligations.

21. Training, exceptions and non-compliance

Personnel with access to Company information receive appropriate privacy, confidentiality and information-security training at induction and periodically thereafter, with enhanced training for those handling KYC, financial, credit, security or privileged information. Confidentiality obligations continue after employment or engagement ends.

Any exception must be documented, time-bound and approved by the responsible business owner and the Information Security and Privacy function after recording the justification, affected data, risks and compensating controls. Exceptions are reviewed before expiry and may be withdrawn if risk changes.

Non-compliance may result in restriction of access, corrective action, disciplinary measures, termination of engagement and legal action, depending on severity. Suspected unlawful conduct may be reported to the appropriate authority. Enforcement must be fair and consistent.

22. Policy review and contact

This Policy is reviewed at least annually, and earlier following a material legal, regulatory, contractual, technological or business change, or a significant incident. Questions and reports may be submitted using the contacts below.